CWE-434: Unrestricted File Upload vulnerabilities

FV Player 8 WordPress plugin versions up to 8.1.7 have an arbitrary file upload vulnerability due to insufficient file type validation in the check_mimetype function. Authenticated users with subscriber-level access or higher can exploit a race condition to upload potentially executable files if certain shortcode or settings are enabled, enabling remote code execution.

The expivi 3D Product configurator for WooCommerce plugin for WordPress contains a critical remote code execution vulnerability in all versions up to and including 2.16.2. This flaw arises from missing authentication and nonce checks combined with unsanitized input in the 'xpv_image' POST parameter, which is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. An attacker can exploit this by sending a single unauthenticated POST request to execute arbitrary code on the server.

The Extensions For CF7 plugin for WordPress, versions up to and including 3.4.5, contains an arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to upload potentially executable files due to insufficient validation of file extensions, MIME types, and file sizes in the signature field. Additionally, the plugin lacks PHP execution restrictions in the upload directory and has a bypass in sanitize_file_name() that enables malicious file names to be accepted. Exploitation can lead to remote code execution.

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

CVE-2026-91844 is a high-severity vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd.'s eimzamip product. It involves an unrestricted file upload flaw allowing potentially dangerous file types to be uploaded. This vulnerability affects versions from 1.6.4 up to but not including 1.6.6.

The Super Forms – Drag & Drop Form Builder plugin for WordPress contains a critical vulnerability (CVE-2026-17609) that allows unauthenticated attackers to recursively delete arbitrary directories on the server. This affects all versions up to and including 6.3.316. The issue arises from insufficient validation of attacker-controlled JSON fields and a bypassable ABSPATH guard, enabling directory deletion when the 'Delete files from server after form submissions' setting is enabled by an administrator.

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The attack requires a preceding step: poisoning the _super_elements post meta via the super_save_form AJAX handler, which lacks a capability and nonce check but requires the attacker to be authenticated as at minimum a Subscriber-level user; the subsequent file upload via super_upload_files requires no authentication at all.

Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34 have a vulnerability allowing local upload configurations that accept XML files to store XML files and stylesheets that execute JavaScript in the Payload origin when opened by a logged-in user. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

## Impact A malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript (XSS) after a user downloads it and opens it. **You are affected if:** - You have a collection configured to upload and allow SVG files which can then be downloaded by users. ## Patches The fix validates SVG content on every upload path and hardens SVG/XML delivery so stored SVGs cannot frame attacker content. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ## Workarounds Disallow SVG uploads, or serve uploaded SVGs as downloads with Content-Disposition: attachment and a strict CSP. These mitigations reduce exposure but do not replace upgrading when the patched release is available.

Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.

Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.

Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.

Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.

Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions.

There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint

A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost versions 6.22.1 through 6.64.0. The issue arises because the default local storage adapter does not enforce content type restrictions on uploaded files, allowing scripts to be hosted on the site's domain. This can lead to compromise of other staff users' admin sessions. The vulnerability is fixed in version 6.64.0.

A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost when creating bookmark cards. Non-image files fetched from external websites could be stored as bookmark icons or thumbnails, allowing any staff user, including Contributors, to host arbitrary HTML on the site's domain. This may lead to compromise of other staff users' admin sessions. The vulnerability affects Ghost versions from 5.94.0 up to but not including 6.64.0. Version 6.64.0 contains a fix for this issue.

A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost where SVG media thumbnails and SVG images uploaded with incorrect file extensions were stored without proper sanitization. This flaw allows any staff user, including Contributors, to host malicious scripts on the site's domain, potentially compromising other staff users' admin sessions. The vulnerability affects Ghost versions from 4.22.0 up to but not including 6.65.0. Version 6.65.0 contains a fix for this issue.

CVE-2026-105644 is a cross-site scripting (XSS) vulnerability in TryGhost Ghost that affects versions from 4.0.0 up to 6.66.x. The issue arises because SVG images included in content imports were stored without proper sanitization. An attacker who tricks an Administrator into importing a crafted SVG file could host malicious scripts on the site's domain, potentially compromising admin user sessions. The vulnerability is fixed in version 6.67.0.